General

  • Target

    5c8b35a836b8c19fb65ab26622c51c03e8c4e7a3dd18bb24427ad2eaaa2f765b.zip

  • Size

    50.9MB

  • Sample

    240713-ma7a8syfnd

  • MD5

    c3709920e86edf39cc1cd64b2c1633fd

  • SHA1

    9a15b5d90ce62d4663e92d0eb886f668459c7152

  • SHA256

    5c8b35a836b8c19fb65ab26622c51c03e8c4e7a3dd18bb24427ad2eaaa2f765b

  • SHA512

    bdca55b156120e84ad0c70746ff3082448a68f37471e9c7160ff5b14a519506e1ac8250db3d90053d06a80fb688346af3eb337350442f444e528f4bf98e46f98

  • SSDEEP

    1572864:YwUZnkmQiygGI2pCITyOHUK3aoX13fMSLh7l1ytp9mxYXgA:Y1ZnjxGI2eQX13fFreK6gA

Score
10/10

Malware Config

Extracted

Family

strela

C2

45.9.74.32

Attributes
  • url_path

    /out.php

  • user_agent

    Mozilla/4.0 (compatible)

Targets

    • Target

      2000.dll

    • Size

      122KB

    • MD5

      431ddb5ded02e5f9b3138b9ecdd8d4a7

    • SHA1

      15068417b80f754122f82fc480aae21f8b3acc95

    • SHA256

      b6daa61f49a160b9d50d181f42cd1b2b8627cc15747a58bf800e42faf9ab67c4

    • SHA512

      c5a6450aa34b82e553429707c13aa90d71692c39a58de5536ad5d7cc8b4ccc6e4cd3edc4e5f11851fa6a0bae960d741664fdec1eac6116b0e5b9bf6aec5a6e07

    • SSDEEP

      3072:OgecGBvs8FWZK9Z5XrhNDYHnoocpAM5fXyuwqYPfAJZG3+1Y7coAOS5SuL:icGBvtEc7hNDYHnwpAMFXyujYPfAJvS2

    Score
    10/10
    • Detects Strela Stealer payload

    • Strela stealer

      An info stealer targeting mail credentials first seen in late 2022.

    • Target

      2001.dll

    • Size

      124KB

    • MD5

      91f67ccca5fd36cc883698adf1476464

    • SHA1

      12d7b345c1dc3599a6a5c74f93e3de6a31a79f90

    • SHA256

      b07c47094623fafcd9747b39dc40eef44d61b668f2849645481ef9088db69550

    • SHA512

      e606078e83359f88faea25e41b8cfd7b25cfe10f921b37f99d71ad4087cd27deedc3a0453bff5f96b6e537c5eb57daf29d788afa628c7a806a1c82945f726c37

    • SSDEEP

      3072:13u2hIcgdtA/Q7XTiT4kinWDTTggnH8yRF/4u0DbjQHHMM:13zhIcEtN7X0DTzncOytZM

    Score
    10/10
    • Detects Strela Stealer payload

    • Strela stealer

      An info stealer targeting mail credentials first seen in late 2022.

    • Target

      2002.dll

    • Size

      122KB

    • MD5

      b193b66fa7c94cc35f8f4ecfa9c9f2c5

    • SHA1

      16dce4705beb09c7e6d54b53c3b8c1cf493b7b60

    • SHA256

      9c526b9aab538b101c1cb50dbf18effb2a9286ccb2cce1612a33a8b51b0ca44f

    • SHA512

      d291818edf021bb7e7c214c0f318150ea8ef28ebe7f7ac71a0e1006d019ad72464973b35d369af26117a312a1ba7df3acb21e3dd603eedd4f912aceecaffb679

    • SSDEEP

      3072:8S4IW4V8UlAgKnmPEU/no9ovZPbZ2W2gEH4nEA0:hPbV8UlAgKnmPE4o9oBPbZd2xY

    Score
    10/10
    • Detects Strela Stealer payload

    • Strela stealer

      An info stealer targeting mail credentials first seen in late 2022.

    • Target

      2003.dll

    • Size

      122KB

    • MD5

      764216493454b0415acfb099215d54e1

    • SHA1

      b44aad389ce67759ada8c9ad4330fc70c3def380

    • SHA256

      357840cc7eb08988db1eb6a7326b8410327faffd0ca39336d27c280876463232

    • SHA512

      e87d299aec48d969fa3416101e5dc443588af493666b36c0aa567e6816825458e5c2e8cccc9e0c10ebe5dcb8e689648141a21ae7f96833b5ebe6d7de67a8847f

    • SSDEEP

      3072:78XuV4dPEJ5uSLtVOtflAsTWeUFOGafSz4dhGZuZ6+FlBoaZ:7SA5J+1wtW+luY+tN

    Score
    10/10
    • Detects Strela Stealer payload

    • Strela stealer

      An info stealer targeting mail credentials first seen in late 2022.

    • Target

      2004.dll

    • Size

      122KB

    • MD5

      44d25c4d6153fa8550aa35d95f662237

    • SHA1

      7fb7541df029adb682e396c6d1f71c062f50a45f

    • SHA256

      124b9f5f62873f178808309f08cc02e903f3485cc903c5f77837a36fc01fb52e

    • SHA512

      a0f007f2a6a4b13df846523f8159d01aa1ffc8e81a4fa0b4654e05a824118cdba755504e2b73b44faffad0f105ce71c8e038d9f3482252c01ccf2ed70c397fd3

    • SSDEEP

      3072:opEQFwsu+wHdmzBZ040+ISJIH7+pEpb9OhoeLv5+eb:oJu+cT+ISJIH7+KpZOv5+

    Score
    10/10
    • Detects Strela Stealer payload

    • Strela stealer

      An info stealer targeting mail credentials first seen in late 2022.

    • Target

      2005.dll

    • Size

      124KB

    • MD5

      c39035b47d03d6ff17e5658b5830cf1d

    • SHA1

      9f4c31661dc32ce5dd0f4d5bca8ec178d710dfaa

    • SHA256

      147177955f0d4dc4eaf6c1274f3d3ce20170d4d97ff05517e67f936f5e7f1708

    • SHA512

      18d6970fb400156fbbe80672133fb8f42af55b4d52b6be97e642e58f3add219166a4e97686280241e7cea6e976d9926a172526ef64bfeb3dd662ceba995943a3

    • SSDEEP

      3072:ls2gck0vlQbSZxKTr2TmnlVl4Qh5+mEi0SEWv:ldhWeKnvPjERfS

    Score
    10/10
    • Detects Strela Stealer payload

    • Strela stealer

      An info stealer targeting mail credentials first seen in late 2022.

    • Target

      2006.dll

    • Size

      124KB

    • MD5

      e24445040d0e88dc0390c4a486747632

    • SHA1

      f6503080cd17b5a00f56c1b1a48b9d5c68340ad7

    • SHA256

      f447f876557dc9f0786c3f1cdeb30247de9979eadf8a646e3c8ebb279e53ced0

    • SHA512

      e6f8daeb99039f1ba87e04d323f1a364ec6fbe5e2c665d41fe9ee2c25e5b4d914784a047c818f0512cb7a6dff07349903db920b9b70900d2bf3125746378787e

    • SSDEEP

      3072:8lsOiGwWiRlla5cyCV6J8KJjoFWsbpaXsq5sqCcXrcK5P:8dN8UVCqjoFWsesqWfcXQW

    Score
    10/10
    • Detects Strela Stealer payload

    • Strela stealer

      An info stealer targeting mail credentials first seen in late 2022.

    • Target

      2007.dll

    • Size

      122KB

    • MD5

      da5925ff8617cd0633915bc5cbcd0745

    • SHA1

      83c892e056b1cc5f433d69145fa6dde75ede4b7b

    • SHA256

      1022aeda5a062194413e8a83dde830f344aec1e4d61fea4b95fb06491631f8d6

    • SHA512

      dfe096e2bd673bbb14393a833e07cec12f623ea8754a570c2158f2bef1b7969cc6eff68493bf6fe5cdb5f51eccc3c9507e324e1ae6540b0c4229a543e6ca3999

    • SSDEEP

      3072:CqIYBOjXlC/7yIAk4mS1bI6wtHCfCEMy:CqIzL8jy7mys/TEH

    Score
    10/10
    • Detects Strela Stealer payload

    • Strela stealer

      An info stealer targeting mail credentials first seen in late 2022.

    • Target

      2008.dll

    • Size

      124KB

    • MD5

      33f2b906aed7fc80eefe0d615f9f8ae6

    • SHA1

      877554f8519368dc1e22c9cc2c24ca861c7d6e2e

    • SHA256

      490bfad070b5fe102d5e438ded9e64da72f164836472583293010ea98b23cf9e

    • SHA512

      fd81b9752d407ad07fcbb57fc65f8af7c35a690dfb2051225835267952a2c2bcc0cc5f08f73f9b6fb8f1376c62e6d3fa9b0c1dfffaf4453de25ca3f9511fee35

    • SSDEEP

      3072:4haKgsismrphv/Go1PUWNcxN+arlVgZkJDwrQoaTm2uYD0sy9wgBuw/yne4X:AisEhnxPA9VgCCr1YEbBHkX

    Score
    10/10
    • Detects Strela Stealer payload

    • Strela stealer

      An info stealer targeting mail credentials first seen in late 2022.

    • Target

      2009.dll

    • Size

      124KB

    • MD5

      7cfc769cae03af48d4271634d7dc3888

    • SHA1

      638616772b711aeab2e016d2ec8aacf9f7254d33

    • SHA256

      6ddbace5f3f349b7383f7f0d6563f95683089873f07288262dc5f574299fe77f

    • SHA512

      3a238f90f4040427ac7ee6c73e7aad87f858b5f35ad29a5adec133f1de4ed74d82071ce4c472d09cc2adf17c5294ede97b4e84026026d0b3210f4f46a116a893

    • SSDEEP

      3072:exUvrFOXflruYtIQ13NcnvbCMxST0g9JK2ez7i:/vrFOvVLIt2KFi

    Score
    10/10
    • Detects Strela Stealer payload

    • Strela stealer

      An info stealer targeting mail credentials first seen in late 2022.

    • Target

      2010.dll

    • Size

      123KB

    • MD5

      041acaec86cb0d59618404599ae423f0

    • SHA1

      d32503b01681d1ccd9befa488fd85a36ae88dbce

    • SHA256

      07207226bc3144d4fdb490bee53d295309c17ebdca4ac249da4c1b60be7d4bef

    • SHA512

      2f8c50c77f61eff51a1d56993cc91d0fe517bd4af8f400c990d6bd431d7c9e00a3689401b6a9ee017cb1525a3376dc2d810f0b1634de7cd8465f4f6c605d2798

    • SSDEEP

      1536:9b3ShcjtQxyUD2r2Cg5Bo9ek7AhDWrSRYa1q1jpQIwFboVzPf8x+WgwuBihAWiG:YqjGx4e8Aw+RaOIwBUsYAu4AWi

    Score
    10/10
    • Detects Strela Stealer payload

    • Strela stealer

      An info stealer targeting mail credentials first seen in late 2022.

    • Target

      2011.dll

    • Size

      123KB

    • MD5

      39903706f220faa86833d48025e7fb82

    • SHA1

      e3fd96aa317a12ea3a7df3f30cf2ff4748902898

    • SHA256

      96f8f7ea115123f18fbe6707453084e1699a3629782524ffdc295ac97c91c906

    • SHA512

      6cafe73db5aa2ac1fa2f8414eeed4db0c135a3d8dc438845e73a660dc2177dd6f6225d3c556deb347df3e857ad67808358e2a0a96905eea372ae1b42643a9cb1

    • SSDEEP

      1536:qBte5KAmYIPitoFm0EYnaOJLPsG6DiHSzbTTdRtOMb8HW/JqSqtsRRFkFBVh9s3y:IqRqPiiGITJZ6DiHSXxqDiRR+VHs3

    Score
    10/10
    • Detects Strela Stealer payload

    • Strela stealer

      An info stealer targeting mail credentials first seen in late 2022.

    • Target

      2012.dll

    • Size

      123KB

    • MD5

      c021d960f71b7dfd8ffb9bcea8dd140c

    • SHA1

      12a8cbd7fccb2ee6035b4c976928a30bec6d8999

    • SHA256

      8f85074b8731a91fafa6da765f9b0d81545e7ad40f2505b5311b3d72a76815fd

    • SHA512

      ed74e6138832ca334a37f027a132adb04acffbff0ff7336e7ab550f3b369876fb3f47eeee6b97dfa9eebdcd5dda0fefe4ed08fff27e67191e4139f298c190aec

    • SSDEEP

      3072:qPrH2RYK6f+x25oRv9P2tMFXICsFbZXhuRt:9yK6fLyvE6uCCtXER

    Score
    10/10
    • Detects Strela Stealer payload

    • Strela stealer

      An info stealer targeting mail credentials first seen in late 2022.

    • Target

      2013.dll

    • Size

      124KB

    • MD5

      5c4fffafadd354b63390b7bcd8ec8f97

    • SHA1

      40eaab039c0da195ee2358f8a3c7d07d29c4e0cf

    • SHA256

      831b05c2a59a3ca9115042aba8925aaed0a912ac9e06245d5a1fa211731e3bfa

    • SHA512

      8208cdf95edaf0acaea81759a89d4224a237568703d9d2a0f950061fed412e5971ef82f535f3fc4f0ad752935562763625b1466a4ececf1025ebacfeca8a84cc

    • SSDEEP

      3072:N7rh7T+4Q0M2Pjnw+RXasw1fJZtOClqa:777Q0hnwOXasb+v

    Score
    10/10
    • Detects Strela Stealer payload

    • Strela stealer

      An info stealer targeting mail credentials first seen in late 2022.

    • Target

      2014.dll

    • Size

      124KB

    • MD5

      d2ae037ffd060ce41b1d95472d117e8b

    • SHA1

      6877dec76bcf7bf032e6d000cf992fee34202343

    • SHA256

      b17b02c0fe97788200ceb716e8acd7a50ee2c1eff49dd5c11296897704363367

    • SHA512

      e4267e512b3a96907f793666fad5f5c8351ab4a066dbc160da0f5f56534006306430fcf771da518e186b480c500180697be5e2564b9a0c05d52d32a6b242a6db

    • SSDEEP

      3072:yXhbE/qRTK7WUSKmQ4P61/bV1GaQ0m8JsNP:yRq7LAQ4PMb7GalNC

    Score
    10/10
    • Detects Strela Stealer payload

    • Strela stealer

      An info stealer targeting mail credentials first seen in late 2022.

    • Target

      2015.dll

    • Size

      127KB

    • MD5

      6f0325b4e10ae4fcf973c4d0c5100ac1

    • SHA1

      4cd329c4c43c66212ea5c716eb4eb7d040a3dfa1

    • SHA256

      1dd34c20bcddbe95eb842076c3c948ac6142f35e40bfac9d218b77105498b4f4

    • SHA512

      25f378fa217ff849408a96dc281ce0add569c85adb0a94e59183edce678082da98030d09d97b37b704459051b5367e57cb25f6a183f72d1082d0de4da78a3742

    • SSDEEP

      3072:0V4GLh8X0/pGyOifVW//ElA9l1qAtLhaxf6I7cGoP65R:0VseGifhij48Gf6II6r

    Score
    10/10
    • Detects Strela Stealer payload

    • Strela stealer

      An info stealer targeting mail credentials first seen in late 2022.

MITRE ATT&CK Matrix

Tasks

static1

Score
3/10

behavioral1

strelastealer
Score
10/10

behavioral2

strelastealer
Score
10/10

behavioral3

strelastealer
Score
10/10

behavioral4

strelastealer
Score
10/10

behavioral5

strelastealer
Score
10/10

behavioral6

strelastealer
Score
10/10

behavioral7

strelastealer
Score
10/10

behavioral8

strelastealer
Score
10/10

behavioral9

strelastealer
Score
10/10

behavioral10

strelastealer
Score
10/10

behavioral11

strelastealer
Score
10/10

behavioral12

strelastealer
Score
10/10

behavioral13

strelastealer
Score
10/10

behavioral14

strelastealer
Score
10/10

behavioral15

strelastealer
Score
10/10

behavioral16

strelastealer
Score
10/10

behavioral17

strelastealer
Score
10/10

behavioral18

strelastealer
Score
10/10

behavioral19

strelastealer
Score
10/10

behavioral20

strelastealer
Score
10/10

behavioral21

strelastealer
Score
10/10

behavioral22

strelastealer
Score
10/10

behavioral23

strelastealer
Score
10/10

behavioral24

strelastealer
Score
10/10

behavioral25

strelastealer
Score
10/10

behavioral26

strelastealer
Score
10/10

behavioral27

strelastealer
Score
10/10

behavioral28

strelastealer
Score
10/10

behavioral29

strelastealer
Score
10/10

behavioral30

strelastealer
Score
10/10

behavioral31

strelastealer
Score
10/10

behavioral32

strelastealer
Score
10/10